{"id":"CVE-2026-109797","kind":"vulnerability","aliases":["CVE-2026-109797"],"related":[],"title":"SAP Astonish: authenticated users can operate on other teams' sandbox containers","description":"In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there.","summary":"Astonish, an SAP project that runs AI agent sandboxes, has a tenant isolation flaw in its legacy Incus sandbox API handlers. A logged-in user can list, expose, proxy and delete containers that belong to another team.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP/astonish","fixed":["v3.6.0"],"affected":"< v3.6.0","ecosystem":"go"}],"ecosystems":[],"tags":["ai-tooling","astonish","incus","sandboxes","self-hosted"],"not_affected_if":["kubernetes-backend","openshell-backend"],"how_to_check":"- Check whether the deployment uses the legacy Incus sandbox backend; Kubernetes and OpenShell deployments are not affected.\n- Check the Astonish version: versions below v3.6.0 are affected.","fix":"Upgrade SAP/astonish to v3.6.0 (handlers now routed through buildPGSessionRegistry() / tenant check)","status":"open","published_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","triaged_at":"2026-11-10T01:28:43+00:00","updated_at":"2026-11-10T01:29:00+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-10T01:28:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP Astonish: authenticated users can operate on other teams' sandbox containers","impact":"medium","summary":"Astonish, an SAP project that runs AI agent sandboxes, has a tenant isolation flaw in its legacy Incus sandbox API handlers. A logged-in user can list, expose, proxy and delete containers that belong to another team.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["astonish","incus","self-hosted","sandboxes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads, exposes or deletes other teams' containers","analyst_note":"Confirm the fixed Astonish version and the Incus backend default via the GitHub vendor advisory linked in the sources.","how_to_check":"- Check whether the deployment uses the legacy Incus backend (Kubernetes and OpenShell deployments are stated as not affected).\n- Check the Astonish version in use against the fixed version in the vendor advisory; the sources do not name it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kubernetes-backend","openshell-backend"],"who_is_affected":"Only deployments of Astonish that use the legacy Incus sandbox backend are affected, per the description. Kubernetes and OpenShell deployments are stated as not affected because the Incus-specific handlers are unavailable there. Exposure requires an authenticated account on the Astonish service.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4640,"output_tokens":563,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Astonish version and the Incus backend default via the GitHub vendor advisory linked in the sources.","search":"'-109797':14A,17A '-2026':13A,16A 'affect':97C,125C,137C 'agent':35B 'ai':20B,34B 'ai-tool':19B 'allow':109C 'anoth':64B,77C 'api':47B,94C 'astonish':2A,22B,28B 'authent':3A,69C 'awar':105C 'backend':130C 'belong':62B 'contain':11A,60B,81C,113C 'containers.the':123C 'could':71C 'cross':111C 'cross-ten':110C 'cve':12A,15A 'delet':59B,122C 'deploy':134C 'expos':56B,118C 'flaw':41B 'handler':48B,95C,98C,144C 'host':27B 'identifi':73C 'improp':84C 'incus':23B,45B,90C,129C,142C 'incus-specif':141C 'isol':40B,86C 'issu':124C 'kubernet':131C 'legaci':44B,89C,128C 'list':55B,117C 'log':51B 'logged-in':50B 'lookup':107C 'manag':93C 'openshel':133C 'oper':6A,75C,114C 'path':108C 'potenti':72C 'project':31B 'proxi':57B,120C 'relev':140C 'run':33B 'sandbox':10A,24B,36B,46B,80C,92C 'sandbox-manag':91C 'sap':1A,30B 'sap/astonish':18A,67C 'self':26B 'self-host':25B 'session':106C 'specif':143C 'team':9A,65B,78C 'tenant':39B,85C,104C,112C 'tenant-awar':103C 'tool':21B 'unavail':146C 'use':101C 'user':4A,53B,70C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Astonish that use the legacy Incus sandbox backend are affected, per the description. Kubernetes and OpenShell deployments are stated as not affected because the Incus-specific handlers are unavailable there. Exposure requires an authenticated account on the Astonish service.","tier":"B","verified":{"fix":{"at":"2026-11-10T01:29:00Z","by":"analyst","doc":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","run_id":2367},"products":{"at":"2026-11-10T01:29:00Z","by":"analyst","doc":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","run_id":2367},"workarounds":{"at":"2026-11-10T01:29:00Z","by":"analyst","doc":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","run_id":2367},"how_to_check":{"at":"2026-11-10T01:29:00Z","by":"analyst","doc":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","run_id":2367},"who_affected":{"at":"2026-11-10T01:29:00Z","by":"analyst","doc":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","run_id":2367}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["sapastonish"],"ptokens":["astonish","sap"],"labels":["aitooling","astonish","high","incus","sandboxes","selfhosted"],"campaign_type":null,"search_a":"'-109797':14A,17A '-2026':13A,16A 'astonish':2A 'authent':3A 'contain':11A 'cve':12A,15A 'oper':6A 'sandbox':10A 'sap':1A 'sap/astonish':18A 'team':9A 'user':4A","search_b":"'agent':35B 'ai':20B,34B 'ai-tool':19B 'anoth':64B 'api':47B 'astonish':22B,28B 'belong':62B 'contain':60B 'delet':59B 'expos':56B 'flaw':41B 'handler':48B 'host':27B 'incus':23B,45B 'isol':40B 'legaci':44B 'list':55B 'log':51B 'logged-in':50B 'project':31B 'proxi':57B 'run':33B 'sandbox':24B,36B,46B 'sap':30B 'self':26B 'self-host':25B 'team':65B 'tenant':39B 'tool':21B 'user':53B","search_c":"'affect':97C,125C,137C 'allow':109C 'anoth':77C 'api':94C 'authent':69C 'awar':105C 'backend':130C 'contain':81C,113C 'containers.the':123C 'could':71C 'cross':111C 'cross-ten':110C 'delet':122C 'deploy':134C 'expos':118C 'handler':95C,98C,144C 'identifi':73C 'improp':84C 'incus':90C,129C,142C 'incus-specif':141C 'isol':86C 'issu':124C 'kubernet':131C 'legaci':89C,128C 'list':117C 'lookup':107C 'manag':93C 'openshel':133C 'oper':75C,114C 'path':108C 'potenti':72C 'proxi':120C 'relev':140C 'sandbox':80C,92C 'sandbox-manag':91C 'sap/astonish':67C 'session':106C 'specif':143C 'team':78C 'tenant':85C,104C,112C 'tenant-awar':103C 'unavail':146C 'use':101C 'user':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:00:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109797","severity":null,"published_at":"2026-11-10T01:17:13+00:00","modified_at":"2026-11-10T01:17:13+00:00","first_seen_at":"2026-11-10T01:26:36+00:00","fetched_at":"2026-11-10T01:26:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109797:2367","url":null,"severity":null,"published_at":"2026-11-10T01:29:00+00:00","modified_at":"2026-11-10T01:29:00+00:00","first_seen_at":"2026-11-10T01:29:00+00:00","fetched_at":"2026-11-10T01:29:00+00:00","note":"Read vendor GHSA: affected < v3.6.0, fixed v3.6.0, no workaround, legacy Incus backend only. Default of Incus backend not stated in advisory."}],"documents":[{"id":112354,"url":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T00:00:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}